Autheo’s THEO token on Base lost about $1.7 million on October 12 after an attacker used a single trusted relayer key to mint 19 million unbacked tokens through the project’s Hyperlane bridge and sell them into liquidity pools.
THEO fell more than 90% within 24 hours, and Autheo has told users not to buy, sell, or bridge the token until it issues an all-clear.
The loss estimate comes from a security alert that Defimon Alerts published at 08:07 UTC on October 13, 2026. Defimon Alerts is a decentralized finance (DeFi) security monitoring feed automated by blockchain security firm Decurity. Blockchain security firm PeckShield separately reported that the minted THEO was swapped for 700.8 Ether (ETH), worth about $1.76 million, and that the ETH was then bridged from Base to the Ethereum mainnet.
How the Unbacked Mint Worked
Hyperlane is a permissionless interoperability protocol that lets blockchains send messages to each other through “Mailbox” smart contracts. Its Warp Routes are token bridges built on that messaging layer, and Autheo’s bridge documentation states that the Autheo Bridge runs on Hyperlane Warp Routes.
On Base, THEO is a HypERC20 token. This is a synthetic version of the token that the warp route mints one-to-one on Base when THEO is locked on Autheo’s own chain. In a correctly backed setup, every THEO on Base should match a THEO locked at the origin.
Hyperlane uses an Interchain Security Module (ISM) to decide whether an incoming cross-chain message is valid. According to Defimon Alerts, THEO’s Base contract was secured by a TrustedRelayerIsm. Hyperlane’s documentation states that this module gives a single relayer address permission to execute arbitrary messages. No validator signatures or other multi-party checks are required.
Hyperlane’s production guide notes that new warp routes deployed through its command line tool use a Trusted Relayer ISM by default, so teams can test without running their own relayers or validators. The same guide tells teams to remove the module before going to production.
In a transaction beginning with 0x4fdbbc5e, the attacker delivered a Hyperlane message from origin domain 2127. That number matches Autheo’s EVM chain identifier, where EVM stands for Ethereum Virtual Machine. The message triggered the handle function on the THEO token contract on Base and minted 19,000,000 THEO from the zero address. No matching collateral was locked on the origin chain.
How the Tokens Were Sold
An orchestrator address beginning with 0x599b then pulled 9.5 million of the newly minted tokens. It routed them through roughly 54 swaps across the THEO/USDC pool, Uniswap v4 positions, and Hydrex pools on Base.
Those sales extracted about $700,000 in Wrapped Ether (WETH), USD Coin (USDC), and Coinbase Wrapped Bitcoin (cbBTC). Defimon Alerts described the activity as part of a multi-transaction dump campaign and estimated the total loss at about $1.7 million.
Hydrex is a decentralized exchange (DEX) on Base. It became THEO’s first trading venue when the token launched on August 20, 2026.
Autheo and MEXC Respond
Autheo posted an urgent security notice on X at 21:14 UTC on October 12. The team said it was investigating an incident involving THEO and advised users not to buy, sell, or bridge the token until an official all-clear.
The notice directed users to support@autheo.com for transaction help. It also warned holders about impersonators and unsolicited fund recovery offers, a common follow-up tactic after crypto exploits.
Centralized exchange MEXC suspended THEO deposits and withdrawals on October 13 at the request of the Autheo team. THEO was listed on MEXC on October 1, 2026.
As of October 13, Autheo has not released a technical postmortem or confirmed the full scope of losses. It also remains unconfirmed whether the relayer key was compromised, misconfigured, or used by an authorized party.
What Is Autheo?
Autheo describes itself as a Layer-0 operating system with an integrated Layer-1 blockchain. Its mainnet went live on May 14, 2026. THEO is the native coin of the Autheo chain and is used for staking and transaction fees. Bridged versions of THEO trade on Base through Hydrex and on Robinhood Chain through Uniswap.
Autheo’s August launch announcement stated that Avelar Labs had audited the bridge between Base and Autheo Mainnet.
On October 8, four days before the incident, Autheo published a blog post analyzing the recent NEAR Intents exploit. The post stressed the need to scrutinize handoffs between deposit infrastructure and smart contracts.
Bridge Security Under Scrutiny Again
The THEO incident adds to a run of cross-chain bridge attacks in 2026 where a single point of verification proved decisive. In April, liquid restaking protocol Kelp DAO lost about $292 million after an attacker pushed a forged message through a bridge setup that relied on one verifier. Kelp DAO and Aave later restored rsETH operations after a recovery effort.
Users are advised to avoid interacting with THEO contracts or bridges until Autheo shares verified updates through its official channels. Figures and technical details may change as the investigation continues.
Also Read: Ledger CryptoBilis Hack Explained: $93M Stolen, Wallets Tampered
